igs-slm 0.1.0b0__py3-none-any.whl

slm/authentication.py

@@ -0,0 +1,198 @@
+"""
+This is taken and modified from here: https://github.com/ahknight/drf-httpsig
+
+There is an http signature IETF standard in the works, presumably a more mature and maintained
+library will emerge at some point - when that happens this should be replaced with that one.
+"""
+
+from functools import lru_cache
+
+from allauth.account import app_settings
+from allauth.account.adapter import get_adapter
+from allauth.account.app_settings import AuthenticationMethod  # do not remove!
+from allauth.account.forms import EmailAwarePasswordResetTokenGenerator
+from allauth.account.utils import user_pk_to_url_str, user_username
+from allauth.utils import build_absolute_uri
+from django.conf import settings
+from django.contrib.auth import get_user_model
+from django.contrib.sites.shortcuts import get_current_site
+from django.urls import reverse
+from django.utils.module_loading import import_string
+from rest_framework import authentication, exceptions
+
+"""
+Reusing failure exceptions serves several purposes:
+    1. Lack of useful information regarding the failure inhibits attackers
+    from learning about valid keyIDs or other forms of information leakage.
+    Using the same actual object for any failure makes preventing such
+    leakage through mistakenly-distinct error messages less likely.
+    2. In an API scenario, the object is created once and raised many times
+    rather than generated on every failure, which could lead to higher loads
+    or memory usage in high-volume attack scenarios.
+"""
+FAILED = exceptions.AuthenticationFailed("Invalid signature.")
+
+
+class SignatureAuthentication(authentication.BaseAuthentication):
+    """
+    DRF authentication class for HTTP Signature support.
+
+    You must subclass this class in your own project and implement the
+    `fetch_user_data(self, keyId, algorithm)` method, returning a tuple of
+    the User object and a bytes object containing the user's secret. Note
+    that key_id and algorithm are DIRTY as they are supplied by the client
+    and so must be verified in your subclass!
+
+    You may set the following class properties in your subclass to configure
+    authentication for your particular use case:
+
+    :param www_authenticate_realm:  Default: "api"
+    :param required_headers:        Default: ["(request-target)", "date"]
+    """
+
+    www_authenticate_realm = "api"
+    required_headers = ["date"]
+
+    def fetch_user_data(self, api_key, algorithm="hmac-sha256"):
+        """Retuns a tuple (User, secret) or (None, None)."""
+        try:
+            user = get_user_model().objects.get(username=api_key)
+            if not user.is_active:
+                return None, None
+            secret = user.secret
+            if isinstance(secret, memoryview):
+                secret = secret.tobytes()
+            return user, secret
+        except get_user_model().DoesNotExist:
+            return None, None
+
+    def authenticate_header(self, request):
+        """
+        DRF sends this for unauthenticated responses if we're the primary
+        authenticator.
+        """
+        h = " ".join(self.required_headers)
+        return 'Signature realm="%s",headers="%s"' % (self.www_authenticate_realm, h)
+
+    def authenticate(self, request):
+        from httpsig import HeaderVerifier, utils
+
+        """
+        Perform the actual authentication.
+
+        Note that the exception raised is always the same. This is so that we
+        don't leak information about in/valid keyIds and other such useful
+        things.
+        """
+        auth_header = authentication.get_authorization_header(request)
+        if not auth_header or len(auth_header) == 0:
+            return None
+
+        method, fields = utils.parse_authorization_header(auth_header)
+
+        # Ignore foreign Authorization headers.
+        if method.lower() != "signature":
+            return None
+
+        # Verify basic header structure.
+        if len(fields) == 0:
+            raise FAILED
+
+        # Ensure all required fields were included.
+        if len(set(("keyid", "algorithm", "signature")) - set(fields.keys())) > 0:
+            raise FAILED
+
+        # Fetch the secret associated with the keyid
+        user, secret = self.fetch_user_data(
+            fields["keyid"], algorithm=fields["algorithm"]
+        )
+
+        if not (user and secret):
+            raise FAILED
+
+        # Gather all request headers and translate them as stated in the Django docs:
+        # https://docs.djangoproject.com/en/1.6/ref/request-response/#django.http.HttpRequest.META
+        headers = {}
+        for key in request.META.keys():
+            if key.startswith("HTTP_") or key in ("CONTENT_TYPE", "CONTENT_LENGTH"):
+                header = key[5:].lower().replace("_", "-")
+                headers[header] = request.META[key]
+
+        # Verify headers
+        hs = HeaderVerifier(
+            headers,
+            secret,
+            required_headers=self.required_headers,
+            method=request.method.lower(),
+            path=request.get_full_path(),
+        )
+
+        # All of that just to get to this.
+        if not hs.verify():
+            raise FAILED
+
+        return (user, fields["keyid"])
+
+
+def initiate_password_resets(users, request=None):
+    """
+
+    :param users: Either an iterable (including queryset) of user accounts or
+        a single user account.
+    :return:
+    """
+    if isinstance(users, get_user_model()):
+        users = [users]
+
+    token_generator = EmailAwarePasswordResetTokenGenerator()
+
+    for user in users:
+        temp_key = token_generator.make_token(user)
+
+        # send the password reset email
+        path = reverse(
+            "account_reset_password_from_key",
+            kwargs=dict(uidb36=user_pk_to_url_str(user), key=temp_key),
+        )
+        url = build_absolute_uri(request, path)
+
+        context = {
+            "current_site": get_current_site(request),
+            "user": user,
+            "password_reset_url": url,
+            "request": request,
+        }
+
+        if app_settings.AUTHENTICATION_METHOD != AuthenticationMethod.EMAIL:
+            context["username"] = user_username(user)
+
+        get_adapter(request).send_mail(
+            "account/email/password_reset_key", user.email, context
+        )
+
+
+@lru_cache(maxsize=None)
+def permissions():
+    try:
+        return import_string(
+            getattr(
+                settings, "SLM_PERMISSIONS", "slm.authentication.default_permissions"
+            )
+        )().all()
+    except ImportError:
+        # this is not critical don't make it mean! - so we fail quietly
+        # a check for this setting is performed in check
+        from django.contrib.auth.models import Permission
+
+        return Permission.objects.all()
+
+
+def default_permissions():
+    from django.contrib.auth import get_user_model
+    from django.contrib.auth.models import Permission
+    from django.contrib.contenttypes.models import ContentType
+
+    return Permission.objects.filter(
+        content_type=ContentType.objects.get_for_model(get_user_model()),
+        codename__in=[perm[0] for perm in get_user_model()._meta.permissions],
+    )

slm/bin/startproject.py

@@ -0,0 +1,262 @@
+import os
+import shutil
+import sys
+from pathlib import Path
+from urllib.parse import urlparse
+
+import django
+from django.conf import settings
+from django_typer.completers import complete_path
+from render_static.engine import StaticTemplateEngine
+from rich.console import Console
+from rich.markdown import Markdown
+from typer import Argument, Option, Typer, secho
+from typing_extensions import Annotated
+
+import slm
+
+template_dir = Path(__file__).parent / "templates"
+
+app = Typer()
+
+
+def yes(response):
+    return not response or response.lower() in ["y", "yes", "true", "1"]
+
+
+REPORT_MARKDOWN = """
+## SLM Project Information
+
+**Your project has been written to:** `{output}`
+
+- **Develop settings:** `{develop}`
+- **Production settings:** `{production}`
+- **Manage Script:** `{site}`
+- **Package Config:** `{pyproject}`
+
+### Installation Instructions
+
+1. Create a database called `{site}`.
+
+2. Use `poetry` to install your project's virtual environment:
+
+    {install_poetry}
+
+    Install dependencies:
+
+    ```bash
+    poetry install
+    ```
+
+3. To install your database and import existing sitelogs, run:
+    
+    ```bash
+    {site} routine install
+    ```
+
+4. To run the development server, run:
+    
+    ```bash
+    network runserver
+    ```
+"""
+
+INSTALL_POETRY = """
+    **You do not have `poetry` installed, see**: https://python-poetry.org/docs/#installing-with-the-official-installer
+"""
+
+
+@app.command(
+    help="Create a directory structure for an slm deployment. This includes settings files and an extension app. You can change any names or settings at a later time!"
+)
+def main(
+    netloc: Annotated[
+        str,
+        Argument(
+            help="The network location of your production deployment will be hosted on. (e.g. slm.igs.org)",
+            show_default=False,
+        ),
+    ],
+    directory: Annotated[Path, Argument(shell_complete=complete_path)] = os.getcwd(),
+    organization: Annotated[
+        str,
+        Option(
+            prompt="What is the name of your organization?",
+            help="What is the name of your organization?"
+        ),
+    ] = "",
+    project_dir: Annotated[
+        str,
+        Option(
+            prompt="What should we name your project directory?",
+            help="What should we name your project directory?",
+        ),
+    ] = "{subdomain}",
+    package_name: Annotated[
+        str,
+        Option(
+            prompt="What should we name your installable wheel?",
+            help="What should we name your installable wheel?",
+        ),
+    ] = "{project_dir}",
+    site: Annotated[
+        str,
+        Option(
+            prompt="What is the name of your site?",
+            help="What is the name of your site?",
+        ),
+    ] = "{subdomain}",
+    production_dir: Annotated[
+        str,
+        Option(
+            prompt="Where should files live in production?",
+            help="Where should files live in production?",
+        ),
+    ] = "/var/www/{site}/production",
+    extension_app: Annotated[
+        str,
+        Option(
+            prompt="What should we call your custom Django app?",
+            help="What should we call your custom Django app?",
+        ),
+    ] = "{org}_extensions",
+    include_map: Annotated[
+        bool,
+        Option(
+            "--include-map",
+            prompt="Install the mapbox map app?",
+            help="Install the mapbox map app?",
+        ),
+    ] = False,
+    use_igs_validation: Annotated[
+        bool,
+        Option(
+            "--use-igs-validation",
+            prompt="Use IGS sitelog validation defaults?",
+            help="Use IGS sitelog validation defaults?",
+        ),
+    ] = False
+):
+    netloc = (urlparse(netloc).netloc or netloc).lower()
+    parts = netloc.split(".")
+    if len(parts) == 2:
+        subdomain = "www"
+        domain = parts[0]
+    elif len(parts) > 2:
+        subdomain = parts[0]
+        domain = parts[1]
+    else:
+        secho("Unable to interpret network location: {netloc}".format(netloc=netloc), fg="red")
+        sys.exit(1)
+
+    if extension_app == "slm":
+        secho(
+            'extension_app cannot be "slm" this will clash with the slm namespace.',
+            fg="red",
+        )
+        sys.exit(1)
+
+    if "." in extension_app:
+        secho(
+            f'extension_app ({extension_app}) cannot have any "." in its name.',
+            fg="red",
+        )
+        sys.exit(1)
+
+    settings.configure(
+        INSTALLED_APPS=[],
+        DEBUG=False,
+        TEMPLATES=[{"BACKEND": "django.template.backends.django.DjangoTemplates"}],
+    )
+    django.setup()
+
+    engine = StaticTemplateEngine(
+        {
+            "ENGINES": [
+                {
+                    "BACKEND": "render_static.backends.StaticDjangoTemplates",
+                    "DIRS": [template_dir],
+                    "OPTIONS": {
+                        "loaders": ["render_static.loaders.StaticFilesystemBatchLoader"]
+                    },
+                }
+            ]
+        }
+    )
+    if not organization:
+        organization = domain.title()
+    org = organization.replace(" ", "_").lower()
+    extension_app = extension_app.format(org=(org or "slm"))
+    site = site.format(subdomain=subdomain).replace(" ", "_").lower()
+    project_dir = project_dir.format(subdomain=subdomain)
+    package_name = package_name.format(project_dir=project_dir)
+
+    # find site packages dir
+    local_slm = None
+    slm_pth = Path(slm.__file__).parent
+    for pth in (Path(pth) for pth in sys.path):
+        if pth.name == "site-packages":
+            if pth not in slm_pth.parents:
+                if yes(
+                    input(
+                        "It looks like you are using a local clone of the SLM, would "
+                        "you prefer to use this instead of a release on pypi? (Y/n): "
+                    )
+                ):
+                    local_slm = os.path.relpath(
+                        slm_pth.parent, directory.absolute().resolve() / project_dir
+                    )
+                break
+
+    ctx = {
+        "netloc": netloc,
+        "subdomain": subdomain,
+        "organization": organization,
+        "org": org,
+        "project_dir": project_dir,
+        "site": site,
+        "production_dir": production_dir.format(site=site),
+        "slm_version": slm.__version__,
+        "extension_app_class": extension_app.title().replace(" ", "").replace("_", ""),
+        "extension_app": extension_app.replace(" ", "_").lower(),
+        "include_map": include_map,
+        "use_igs_validation": use_igs_validation,
+        "package_name": package_name.replace("_", "-").replace(" ", "-"),
+        "local_slm": local_slm,
+    }
+    engine.render_to_disk(
+        "{{ project_dir }}/**",
+        context=ctx,
+        dest=directory,
+        exclude=[template_dir / "{{ project_dir }}/{{ extension_app }}/templates"],
+    )
+    engine.render_to_disk(
+        "{{ project_dir }}/{{ extension_app }}/templates/**",
+        context=ctx,
+        dest=directory,
+        render_contents=False,
+    )
+
+    output = (directory / project_dir).absolute().resolve()
+    assert output.is_dir() and output.exists()
+
+    Console().print(
+        Markdown(
+            REPORT_MARKDOWN.format(
+                output=output,
+                develop=(output / "sites" / site / "develop/__init__.py").relative_to(
+                    output
+                ),
+                production=(
+                    output / "sites" / site / "production/__init__.py"
+                ).relative_to(output),
+                site=site,
+                install_poetry=INSTALL_POETRY if not shutil.which("poetry") else "",
+                pyproject=(output / "pyproject.toml").relative_to(output),
+            )
+        )
+    )
+
+
+if __name__ == "__main__":
+    app()

slm/bin/templates/{{ project_dir }}/pyproject.toml

@@ -0,0 +1,35 @@
+[tool.poetry]
+name = "{{ package_name }}"
+version = "0.1.0"
+description = ""
+authors = []
+
+packages = [
+    { include = "{{ extension_app }}" },
+    { include = "sites" },
+]
+
+exclude = ["**/test"]
+
+[tool.poetry.scripts]
+{{ site }} = "sites.{{ site }}.manage:main"
+
+[tool.poetry.dependencies]
+python = "^3.8"
+{% if local_slm %}
+igs-slm = { path = "{{ local_slm }}", develop = true }
+#igs-slm = "^{{ slm_version }}"
+{% else %}
+igs-slm = "^{{ slm_version }}"
+{% endif %}
+
+[tool.poetry.group.dev.dependencies]
+django-extensions = "^3.1.5"
+ipython = "^8.12.2"
+ipdb = "^0.12"
+django-debug-toolbar = "^4.0.0"
+
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"

slm/bin/templates/{{ project_dir }}/sites/{{ site }}/base.py

@@ -0,0 +1,15 @@
+from split_settings.tools import include, optional
+from slm.settings import resource, set_default, get_setting
+
+set_default("SLM_ORG_NAME", "{{ organization }}")
+include(resource("slm.settings", "root.py"))
+include(optional('./validation.py'))
+
+INSTALLED_APPS = [
+    "{{ extension_app }}",
+    {% if not include_map %}# {% endif %}"slm.map",
+    *get_setting("INSTALLED_APPS", [])
+]
+
+
+ROOT_URLCONF = "sites.{{ site }}.urls"

slm/bin/templates/{{ project_dir }}/sites/{{ site }}/develop/__init__.py

@@ -0,0 +1,56 @@
+"""
+This is the local Django configuration for the development configuration of your SLM
+project.
+"""
+
+from split_settings.tools import (
+    include,
+    optional
+)
+from slm.settings import set_default
+from pathlib import Path
+
+SITE_DIR = Path(__file__).resolve().parent
+BASE_DIR = SITE_DIR
+
+ALLOWED_HOSTS = ['localhost', '127.0.0.1']
+
+DEBUG = True
+DJANGO_DEBUG_TOOLBAR = True
+
+include('../base.py')
+
+set_default("SILENCED_SYSTEM_CHECKS", []).extend([
+    "security.W004",
+    "security.W008",
+    "security.W018"
+])
+
+# Special configuration parameters for your local development instance should be
+# placed here:
+include(optional('local.py'))
+
+set_default(
+    'DATABASES',
+    {
+        'default': {
+            'ENGINE': 'django.contrib.gis.db.backends.postgis',
+            'NAME': '{{ site }}',
+            'USER': 'postgres',
+            'PASSWORD': '',
+            'ATOMIC_REQUESTS': True,
+        }
+    }
+)
+
+WSGI_APPLICATION = "sites.{{ site }}.develop.wsgi.application"
+
+CACHES = {
+    'default': {
+        'BACKEND': 'django.core.cache.backends.locmem.LocMemCache'
+    }
+}
+
+INSTALLED_APPS.insert(1, 'django_extensions')
+
+SECURE_SSL_REDIRECT = False

slm/bin/templates/{{ project_dir }}/sites/{{ site }}/develop/local.py

@@ -0,0 +1,4 @@
+# TODO - this file should be excluded from version control
+
+# place any local development settings here - these may be developer specific so
+# this file should not be checked into version control

slm/bin/templates/{{ project_dir }}/sites/{{ site }}/develop/wsgi.py

@@ -0,0 +1,16 @@
+"""
+WSGI config for SLM production deployment.
+
+It exposes the WSGI callable as a module-level variable named ``application``.
+
+For more information on this file, see
+https://docs.djangoproject.com/en/stable/howto/deployment/wsgi/
+"""
+
+import os
+
+from django.core.wsgi import get_wsgi_application
+
+os.environ.setdefault('DJANGO_SETTINGS_MODULE', "sites.{{ site }}.develop")
+
+application = get_wsgi_application()

slm/bin/templates/{{ project_dir }}/sites/{{ site }}/manage.py

@@ -0,0 +1,34 @@
+"""Load SLM in management mode and run management commands."""
+import os
+import sys
+
+
+# Use SLM_DEPLOYMENT environment variable to switch between deployments. In
+# production you may want to just set this to "production" in your
+# administrative user's shell profile
+def main(default_settings: str = f"sites.{{ site }}.{os.environ.get('SLM_DEPLOYMENT', 'develop')}"):
+    """Run administrative tasks."""
+
+    # SLM configures loggers differently when running management commands so we can
+    # distinguish logs on the server that were from requests or admin tasks. This
+    # environment variable is used to signal that the SLM runtime is in management
+    # mode.
+    if len(sys.argv) > 1 and sys.argv[1] != "runserver":
+        os.environ['SLM_MANAGEMENT_FLAG'] = 'ON'
+
+    # Django bootstraps off the settings file defined in this import path.
+    os.environ.setdefault('DJANGO_SETTINGS_MODULE', default_settings)
+
+    try:
+        from django.core.management import execute_from_command_line
+    except ImportError as exc:
+        raise ImportError(
+            "Couldn't import Django. Are you sure it's installed and "
+            "available on your PYTHONPATH environment variable? Did you "
+            "forget to activate a virtual environment?"
+        ) from exc
+    execute_from_command_line(sys.argv)
+
+
+if __name__ == "__main__":
+    main()

slm/bin/templates/{{ project_dir }}/sites/{{ site }}/production/__init__.py

@@ -0,0 +1,61 @@
+from split_settings.tools import include
+from pathlib import Path
+import getpass
+
+WSGI_APPLICATION = "sites.{{ site }}.production.wsgi.application"
+
+DEBUG = False
+SITE_DIR = Path("{{ production_dir }}")
+BASE_DIR = SITE_DIR
+
+ALLOWED_HOSTS = [
+    '{{ netloc }}',
+    # in some production configurations you may need to add your server's ip address
+    # to this list
+]
+SLM_SITE_NAME = '{{ netloc }}'
+
+
+MEDIA_ROOT = SITE_DIR / 'media'
+STATIC_ROOT = SITE_DIR / 'static'
+
+
+# This section deals with database connection. Alterations may need to be made for
+# deployment. We recommend running a database locally and using postgres user
+# authentication and disallowing any non-local connections. This means your database
+# is as secure as the system user running your SLM deployment.
+# 
+# You may of course, use any number of database settings or have multiple databases:
+# https://docs.djangoproject.com/en/stable/ref/databases/
+DATABASES = {
+    'default': {
+        'ENGINE': 'django.contrib.gis.db.backends.postgis',
+        'NAME': '{{ site }}',
+        'USER': getpass.getuser(),  # if postgres is configured for user authentication
+        'ATOMIC_REQUESTS': True
+    },
+}
+
+# The SLM uses geodjango. Unless gdal and geos are in standard locations on your production
+# server you will have to set their paths explicitly here:
+# https://docs.djangoproject.com/en/stable/ref/contrib/gis/install/geolibs/
+# TODO
+# GDAL_LIBRARY_PATH = "/path/to/libgdal.so"
+# GEOS_LIBRARY_PATH = '/path/to/libgeos_c.so.1'
+
+# Make sure debug toolbar is not run in production - it can expose secrets!
+DJANGO_DEBUG_TOOLBAR = False
+
+include('../base.py')
+
+# ADMINS will receive email notifications when exceptions are encountered or 500 errors
+# returned to user requests
+ADMINS = [
+    #("Your Name", "Email Address")
+]
+
+# Change this setting if you would like the links serialized into site logs or geodesyml
+# files to use a different domain than the one of this deployment.
+# For example, IGS's SLM is running on https://slm.igs.org but our public facing downloads
+# are from https://network.igs.org
+# SLM_FILE_DOMAIN = 'https://{{ netloc }}'